Public API
Reviewed
🔌
Talk to the platform directly.
The fortrabbit public API is a REST interface to apps, environments, deployments and domains. It authenticates with a personal API token and is the foundation the CLI and the MCP server build on.
This article is a draft and the API itself is in beta. Both the endpoints and this page will keep changing. API tokens cannot be created in the production dashboard yet.
About the public API
The API covers the objects the dashboard works with: apps, environments, deployments, domains, teams, people and payment methods. It speaks JSON over HTTPS and is versioned in the URL.
API reference docs
The full endpoint reference is generated from the API itself and lives at:
Entry point
All endpoints sit under a single base URL:
https://api.fortrabbit.com/v1
Send Accept: application/json on every request. Without it the API answers in JSON-LD, which carries extra @-prefixed metadata most clients do not expect.
Authentication
The API authenticates with a personal API token, created in the dashboard from the account menu under API tokens. The full token is shown once, right after creation, and cannot be retrieved later — store it before leaving the page. The listing afterwards shows only the last four characters.
Pass the token as a bearer token on every request:
curl https://api.fortrabbit.com/v1/apps \
-H "Authorization: Bearer frbit-at-YOUR-TOKEN" \
-H "Accept: application/json"
A token acts as the person who created it and sees exactly what that person sees in the dashboard — no more. Revoking a token in the dashboard takes effect immediately.
What the API covers
| Resource | Path |
|---|---|
| Apps | /v1/apps |
| Environments | /v1/environments |
| Deployments | /v1/deployments, /v1/environments/{id}/deployments |
| Domains | /v1/domains |
| Teams | /v1/teams |
| People | /v1/people |
| Payment methods | /v1/payment-methods |
Objects are addressed by their public ID — the same short ap-, en-, do- identifiers the dashboard shows. Collections accept a repeated publicId[] parameter to fetch several known objects in one call.
Rate limits
Requests are counted per token in a sliding window of one minute, currently at around 20 per minute. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; a rejected request answers 429 and adds Retry-After with the seconds to wait.
Failed authentications are counted separately, per IP address. Retrying a rejected credential in a loop locks the address out rather than the token.
Stability
The API is in beta, like the platform itself. Breaking changes are possible while that lasts, so pin nothing that cannot be adjusted. The /v1 prefix marks the shape of the API, not a frozen contract.